OpenAI: GPT‑5.6 Sol model finds critical flaw in PHP, which runs 70% of websites

OpenAI announced that its GPT‑5.6 Sol model found a critical flaw in PHP, one of the most widely used server-side languages. According to the company, PHP runs on roughly 70% of websites worldwide. For the past two months, OpenAI has led a coalition of maintainers, researchers and security vendors that worked on fixing critical problems in the language. The blog post went up a few hours ago, and Chinese outlets, including Jiqizhixin, are already calling the incident one of the most influential vulnerabilities in the project's history.

Two months of silence before publication

The loud announcement was the end of a long preparation. Two months ago, the story began not with a press release but with a closed communication channel between OpenAI and the people responsible for the PHP codebase. This process is known as coordinated disclosure: the vulnerability is first reported quietly to the maintainers, then patches are prepared for supported branches, major hosting and security vendors are warned, and only after that is the public told.

What sets this story apart from routine bug reports is that OpenAI did not simply hand over a report but led the coalition. The company took on the role of organizer. That function is usually performed by the projects themselves, by CERT centers or by large vendors such as Google and Microsoft.

Why PHP

PHP appeared in the mid-1990s and still underpins a huge part of the web: WordPress, Drupal, Magento, Laravel and countless corporate sites are built on it. A flaw in the language itself or in its standard components affects not one product but the entire chain: from the core to plugins, hosting images and containers that sit in production for years without updates.

That is why the 70% figure matters more here than a line in someone's vulnerability description. Even if exploitation requires certain conditions, the number of potentially affected servers runs into the millions. And PHP has a particular quirk: many installations run on outdated versions that stopped receiving fixes long ago.

The model as bug hunter

Until now, high-profile examples of finding vulnerabilities with AI involved narrow tasks: Google Big Sleep found a bug in SQLite, and teams at the DARPA AIxCC competition fixed code automatically. The GPT‑5.6 Sol case raises the stakes: it concerns a critical problem in a core runtime watched by thousands of eyes, and a finding that required a full multi-party remediation effort.

For the industry, this is a signal in two directions at once. Models give defenders a chance to audit mature projects faster than human teams can. But the same tools are available to attackers, which means the window between a patch being published and exploits appearing will shrink.

Key parameters of the story:

• Model: GPT‑5.6 Sol
• Target: PHP, an open-source programming language
• Reach: about 70% of websites worldwide
• Coordination period: about two months
• Participants: maintainers, researchers, security vendors
• Coalition organizer: OpenAI

What teams running PHP in production should do

First, take inventory. Work out which PHP versions are actually running on your servers, in containers and at your hosting provider, especially in forgotten projects and old CMS installations. Second, follow official PHP security releases and the mailing lists of your distribution or host. When patches for supported branches come out, it is best to update quickly: once a fix is published, attackers get a hint about where to look.

Third, a question for those still on versions that are no longer supported. Fixes may never be released for them, so it is better to start planning a migration to a current branch before the first exploits appear, not after. Finally, make sure you have monitoring for unusual activity on web servers and a WAF that can quickly enable virtual patches.

There is also a strategic takeaway for those who build security processes: AI auditing of open-source code is becoming a working tool. It is time to run such checks on your own dependencies now, before someone else does.